What is a network security perimeter?

Azure Network Security Perimeter creates logical network boundaries around your platform-as-a-service (PaaS) resources that you deploy outside your virtual networks. By establishing a secure perimeter, network security perimeter helps you control public network access to resources like Azure Storage accounts and Azure Key Vault.

By default, network security perimeter restricts public access to PaaS resources within the boundary. You can grant exceptions through explicit access rules for inbound and outbound traffic. This approach helps prevent data exfiltration while maintaining necessary connectivity for your applications.

For access patterns that involve traffic from virtual networks to PaaS resources, see What is Azure Private Link?

Features of a network security perimeter include:

• Resource-to-resource access communication within perimeter members, which prevents data exfiltration to nonauthorized destinations.
• External public access management with explicit rules for PaaS resources associated with the perimeter.
• Access logs for audit and compliance.
• Unified experience across PaaS resources.

Components of a network security perimeter

A network security perimeter includes the following components:

Network security perimeter properties

When creating a network security perimeter, you can specify the following properties:

Access modes in network security perimeter

Administrators add PaaS resources to a perimeter by creating resource associations. You can make these associations in two access modes. The access modes are:

To learn more about moving from transition mode (formerly learning mode) to enforced mode, see Transitioning to a network security perimeter.

Why use a network security perimeter?

A network security perimeter provides a secure perimeter for communication of PaaS services deployed outside the virtual network. It allows you to control network access to Azure PaaS resources. Some common use cases include:

• Create a secure boundary around PaaS resources.
• Prevent data exfiltration by associating PaaS resources to the perimeter.
• Enable access rules to grant access outside the secure perimeter.
• Manage access rules for all the PaaS resources within the network security perimeter in a single pane of glass.
• Enable diagnostic settings to generate access logs of PaaS resources within the perimeter for audit and compliance.
• Allow private endpoint traffic without the need for explicit access rules.

How does a network security perimeter work?

When you create a network security perimeter and associate PaaS resources with the perimeter in enforced mode, you deny all public traffic by default. This setup prevents data exfiltration outside the perimeter.

Use access rules to approve public inbound and outbound traffic outside the perimeter. Approve public inbound access by using the network and identity attributes of the client, such as source IP addresses and subscriptions. Approve public outbound access by using FQDNs (Fully Qualified Domain Names) of the external destinations.

By using standard service endpoint, a network security perimeter can also authorize inbound traffic by using network identifiers — public IP addresses or prefixes associated with service endpoint subnets. This approach provides scalable, identity-based IaaS-to-PaaS connectivity without requiring individual IP-based access rules.

For example, when you create a network security perimeter and associate a set of PaaS resources with the perimeter, such as Azure Key Vault and Azure Storage, in enforced mode, you deny all incoming and outgoing public traffic to these PaaS resources by default. To allow any access outside the perimeter, create the necessary access rules. Within the same perimeter, create profiles to group PaaS resources with similar sets of inbound and outbound access requirements.

Onboarded private link resources

A network security perimeter-aware private link resource is a PaaS resource that you can associate with a network security perimeter. Currently, the onboarded private link resources are as follows:

Where is network security perimeter available?

Network security perimeter is currently available in all Azure public cloud regions and in Azure Government regions (US Gov Virginia, US Gov Texas, US Gov Arizona, US DoD East, and US DoD Central).

Supported access rule types

Network security perimeter supports the following access rule types:

Limitations of a network security perimeter

Logging limitations

While enabling access logs for network security perimeter, the Log Analytics workspace to associate with the network security perimeter needs to be located in one of the Azure Monitor supported regions.

Microsoft Sentinel limitations

The following limitations are known:

• Network security perimeters aren't supported for Log Analytics workspaces enabled for Microsoft Sentinel. If you enable a network security perimeter on the workspace, analytic rules are automatically disabled. For more information, see Prerequisites for deploying Microsoft Sentinel.
• Azure Backup isn't supported for Storage Accounts enabled with network security perimeter. Don't associate a storage account with network security perimeter if you enable backups or if you plan to use Azure Backup.
• Querying workspaces with private link from Advanced hunting isn't supported.

Scale limitations

Network security perimeter functionality can be used to support deployments of PaaS resources with common public network controls with following scale limitations:

Other limitations

Network security perimeter has other limitations as follows:

Next steps